1fanwang opened a new pull request, #66325: URL: https://github.com/apache/airflow/pull/66325
## Why `_build_mysql_cnf` (introduced in #65575) forwards an allowlist of SQLAlchemy URL query keys (`ssl_ca`, `ssl_cert`, `ssl_key`, `ssl_cipher`, `ssl_mode`, `charset`) into the `[client]` section of the temporary my.cnf written by `airflow db shell`. The values are written without sanitization. SQLAlchemy's URL parser percent-decodes query values, so a `sql_alchemy_conn` containing `%0A` or `%0D` in any of those values would inject extra option lines into the `[client]` section. Example: ``` sql_alchemy_conn = mysql://root@h:3306/d?ssl_ca=/etc/ssl/ca.crt%0Amalicious=evil ``` renders as: ``` [client] ... ssl-ca = /etc/ssl/ca.crt malicious = evil ``` The password field already escapes via `_quote_mysql_password_for_cnf`; this is the asymmetric defense-in-depth gap on the rest. ## Fix Strip CR/LF in a small `_strip_newlines` helper applied to each forwarded value. Adds a regression test exercising both `%0A` and `%0D` in `ssl_ca`. ## Threat model `sql_alchemy_conn` is set by the airflow admin via `airflow.cfg` or env. An admin who can write a malicious URL already has process-level control. The case this defends against is templated/secret-managed configs where a `%0A` in an upstream value silently turns into an option-injection through the `db shell` CLI path. Same intent as the existing password escape. ## Tests ``` pytest airflow-core/tests/unit/cli/commands/test_db_command.py -v -k "build_mysql_cnf" ... 7 passed ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
